Stored Cross‑Site Scripting is present in the StockAgile API and web interface. The REST endpoint '/inventory/configuration/serial-number-types' accepts parameters such as 'code' and 'name' that are stored unfiltered. Once stored, the malicious JavaScript is rendered to authenticated users, giving an attacker the ability to run arbitrary code within the victim’s browser. Because the code executes in the context of the user’s session, it can steal authentication cookies, deface the UI, or perform unauthorized actions on behalf of the user. This vulnerability is a classic input validation error (CWE‑79) that undermines the confidentiality, integrity, and availability of the affected session.

Novadigits technologies’ StockAgile application is affected. No specific version information is supplied, so the risk applies to all current releases of StockAgile that contain the mentioned endpoint.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that there is no known widespread exploitation. However, the attack requires the attacker to be a previously authenticated user, meaning that credential compromise or social engineering could enable the exploit. With no official patch yet, the risk remains until an update or fix is released.